Digital Guardian ARC Modeling Rule

Details

ID	`DigitalGuardianModelingRule`
From Version	8.2.0

Rules (XIF)

[MODEL: dataset = "digital_guardian_arc_raw"]
alter
    xdm.alert.original_alert_id = inc_id,
    xdm.alert.name = dg_name,
    xdm.alert.severity = inc_sev,
    xdm.alert.description = dg_description,
    xdm.target.user.username = inc_assign,
    xdm.event.type = dg_utype,
    xdm.source.user.username = inc_creator,
    xdm.alert.subcategory = inc_state,
    xdm.event.id = dg_guid;

Schema

`digital_guardian_arc_raw`

Field	Type	Array?
`dg_comment`	string	—
`dg_description`	string	—
`dg_guid`	string	—
`dg_name`	string	—
`dg_tenant`	string	—
`dg_utype`	string	—
`inc_assign`	string	—
`inc_creator`	string	—
`inc_id`	string	—
`inc_mtime`	datetime	—
`inc_sev`	string	—
`inc_state`	string	—

Raw JSON

{
    "digital_guardian_arc_raw": {
        "dg_name": {
            "type": "string",
            "is_array": false
        },
        "inc_creator": {
            "type": "string",
            "is_array": false
        },
        "inc_assign": {
            "type": "string",
            "is_array": false
        },
        "inc_state": {
            "type": "string",
            "is_array": false
        },
        "dg_description": {
            "type": "string",
            "is_array": false
        },
        "inc_id": {
            "type": "string",
            "is_array": false
        },
        "dg_comment": {
            "type": "string",
            "is_array": false
        },
        "inc_mtime": {
            "type": "datetime",
            "is_array": false
        },
        "dg_guid": {
            "type": "string",
            "is_array": false
        },
        "inc_sev": {
            "type": "string",
            "is_array": false
        },
        "dg_utype": {
            "type": "string",
            "is_array": false
        },
        "dg_tenant": {
            "type": "string",
            "is_array": false
        }
    }
}